Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
2d8014ac8ee54a6f25410b3053359a084403062dae06f317623b9cf08b34271f
-
Size
850KB
-
Sample
230607-k2pjdshh8z
-
MD5
cfb32317f4ce201471305c0b06406cfe
-
SHA1
d4772f1d85ed9ed66d2ce0c81af24c5ceae2dc49
-
SHA256
2d8014ac8ee54a6f25410b3053359a084403062dae06f317623b9cf08b34271f
-
SHA512
9e31df7421799e7441fe5d68a35b7e40e5fe8de305bbaec8680a666cc7f803fbeff27dbfc1707a29857d86aa00f13fadf28067bcb505751ce425fa1814bafc36
-
SSDEEP
12288:ZMrdy90arC53BPWVtjj07gthhpnOn+KcPSxf5LYS6Wr7OLKjMTTLz5N76LvXI:ky9+l2pI7848CyC/O/j3+E
Static task
static1
Behavioral task
behavioral1
Sample
2d8014ac8ee54a6f25410b3053359a084403062dae06f317623b9cf08b34271f.exe
Resource
win10v2004-20230221-en
Malware Config
Extracted
redline
loxa
83.97.73.129:19068
-
auth_value
c709e1d3fce1e71b1abb95c0a30242b8
Targets
-
-
Target
2d8014ac8ee54a6f25410b3053359a084403062dae06f317623b9cf08b34271f
-
Size
850KB
-
MD5
cfb32317f4ce201471305c0b06406cfe
-
SHA1
d4772f1d85ed9ed66d2ce0c81af24c5ceae2dc49
-
SHA256
2d8014ac8ee54a6f25410b3053359a084403062dae06f317623b9cf08b34271f
-
SHA512
9e31df7421799e7441fe5d68a35b7e40e5fe8de305bbaec8680a666cc7f803fbeff27dbfc1707a29857d86aa00f13fadf28067bcb505751ce425fa1814bafc36
-
SSDEEP
12288:ZMrdy90arC53BPWVtjj07gthhpnOn+KcPSxf5LYS6Wr7OLKjMTTLz5N76LvXI:ky9+l2pI7848CyC/O/j3+E
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-